ISO roles

The standards expect you to know who looks after what. In Peilaro that is an ISO role, such as the management representative or the internal auditor. A role owns clauses and has recurring tasks. It is not an access right: what someone may do in Peilaro still comes from their role as owner, admin or member under Members.

You find the roles under your name, at ISO roles. Every member sees who holds which role. Owners and admins add, change and give them.

Start with the suggested roles

When there are no roles yet, choose Add the suggested roles. Peilaro adds the roles that fit the standards you have switched on:

• the management representative, with the management review once a year (clause 9.3) and the certification or surveillance audit;
• the internal auditor, with the internal audit once a year (clause 9.2);
• the process owner, with a process review every six months (clause 8.1);
• with ISO 27001, the information security officer, with the access rights review every six months and the risk assessment once a year;
• with ISO 14001, the environmental coordinator, with the evaluation of compliance obligations and the review of environmental aspects.

The suggestions use clause numbers and our own words, never the text of the standard. You can change everything. Switched on another standard later? Choose Add the suggested roles again: only the roles that are new are added.

You can also add a role of your own, with a name, a short description and the clauses it owns. A chapter covers every clause in it.

Give a role to a colleague

Under a role, choose Change who holds it and tick the colleagues. A role can have more than one holder.

When a role gets its first holder, its tasks go on the annual plan as checks that follow the role. Nobody is named on such a check, so the reminder goes to whoever holds the role at that moment. When someone leaves your organisation, their roles go back and the tasks go to the other holders.

A role that nobody holds shows as Nobody yet, on this page and under Needs attention on the overview. Its reminders go to the owners and admins until someone has it.

Conflicts of interest

Someone who audits should not audit their own area or their own work. Mark a role as Independent for that, as the internal auditor is. Peilaro then warns you when the holder:

• also holds a role that owns the same clauses, or
• wrote how one of those clauses is met, or is responsible for it.

Giving the role anyway is possible in a small team: tick that you go ahead and write a short note why, for example that an external auditor checks this area. The note stays with the role and is logged. An internal audit on the annual plan shows the same warning when the person doing it owns the clause.

Who gets the reminders

A reminder about a check goes to the member named on it. Without one, it goes to whoever holds the role of the check, then to whoever holds the role that owns its clause, and otherwise to the owners and admins. Findings without an owner follow the role that owns their clause in the same way.